Brewtools:Secrets Scan

Secrets Scan

<phase name="1-setup">

Phase 1: Setup

EXECUTE using Bash tool:

git rev-parse --is-inside-work-tree 2>/dev/null || { echo "ERROR: Not git repo"; exit 1; }
REPO=$(git rev-parse --show-toplevel) && cd "$REPO"
TS=$(date +%Y%m%d-%H%M%S)
DIR="$REPO/.claude/reports/${TS}_secrets-scan" && mkdir -p "$DIR"
git ls-files > "$DIR/files.txt"
echo "DIR=$DIR|REPO=$REPO|TS=$TS|TOTAL=$(wc -l < "$DIR/files.txt" | tr -d ' ')"
cat "$DIR/files.txt"

STOP if ERROR — must run in git repository.

</phase>

<phase name="2-parallel-scan">

Phase 2: Split & Launch 10 Agents

1. Parse file list → split into 10 chunks (ceil(total/10)) 2. Send 10 Task calls in parallel (single message)

Config: Task(subagent_type="general-purpose", model="haiku", description="Agent N/10 scan")

<agent-prompt> Agent {N}/10 secrets scanner.

FILES: {FILES}

Read each file → detect secrets → return JSON.

PATTERNS:

CRITICALITY:

SKIP: env refs (process.env.*, ${VAR}, os.getenv()), placeholders, docs/comments.

OUTPUT (JSON):

{"agent":{N},"scanned":["f1","f2"],"skipped":[{"path":"x","reason":"binary"}],"findings":[{"path":"f","line":1,"content":"pwd=x","desc":"Hardcoded pwd","crit":"HIGH"}]}

No findings: "findings":[] </agent-prompt>

</phase>

<phase name="3-merge">

Phase 3: Merge Results

1. Collect 10 JSON responses 2. Parse each (handle errors gracefully) 3. Merge scanned[], skipped[], findings[] 4. Dedupe by path+line 5. Sort: CRITICAL → HIGH → MEDIUM → LOW

</phase>

<phase name="4-report">

Phase 4: Generate Report

Write {DIR}/report.md:

<report-template>

Secrets Scan Report

Scan: {TS} | Repo: {REPO} | Files: {TOTAL} | Agents: 10

Summary

Findings

CRITICAL ({N})

{ROWS}

HIGH / MEDIUM / LOW

(same table format)

Agent Stats

File Inventory

Scanned ({N})

{ALL}

Skipped ({N})

{SKIP} </report-template>

</phase>

<phase name="5-summary">

Phase 5: Display Summary

## Secrets Scan Complete

| Metric | Value |
|--------|-------|
| Files | {N} |
| CRITICAL | {N} |
| HIGH | {N} |
| MEDIUM | {N} |
| LOW | {N} |

Report: {DIR}/report.md

</phase>

<phase name="6-fix">

Phase 6: Fix Mode

Trigger: --fix arg OR CRITICAL/HIGH findings exist → AskUserQuestion

</phase>

Secrets Scan

Security audit for leaked credentials in git-tracked files. Spawns 10 parallel agents to scan the entire repository, classifies findings by severity, and generates a detailed report with optional interactive remediation.

Quick Start

/brewtools:secrets-scan

Modes

Fix mode options per finding:

Examples

Good Usage

# Pre-commit security check on the full repo
/brewtools:secrets-scan

# Scan and fix all findings interactively
/brewtools:secrets-scan --fix

# Run after onboarding a new contributor to verify no secrets leaked
/brewtools:secrets-scan

# Run before open-sourcing a private repo
/brewtools:secrets-scan --fix

# Periodic audit as part of a security review cycle
/brewtools:secrets-scan

Common Mistakes

# Running outside a git repository -- the skill requires git-tracked files
cd /tmp && /brewtools:secrets-scan
# ERROR: Not git repo

# Ignoring CRITICAL findings -- always remediate HIGH and CRITICAL before pushing
/brewtools:secrets-scan
# -> 3 CRITICAL findings... (do not ignore these)

# Assuming a clean scan means zero risk -- the skill detects patterns, not all secrets
# Always combine with .gitignore rules and pre-commit hooks for defense in depth

What It Detects

Skipped automatically: environment variable references (process.env.*, ${VAR}, os.getenv()), common placeholders (changeme, YOUR_KEY, xxx, dummy), documentation comments, binary files.

Severity Levels

Output

Report location: .claude/reports/{TIMESTAMP}_secrets-scan/report.md

The report contains:

A console summary is also displayed at the end of the scan with the key metrics and the path to the full report.

Tips

• Run early, run often. The best time to catch a leaked secret is before it reaches a remote branch. Use this skill as a pre-push check.
• Expect false positives. Pattern-based detection will flag test fixtures, example configs, and documentation snippets. Use --fix to mark them as false positives and move on.
• Combine with .gitignore. After identifying sensitive files, add them to .gitignore immediately. The --fix mode offers this as a one-click option.
• Check the LOW findings too. Placeholder values like changeme sometimes slip into production configs unchanged. A quick review of LOW findings can prevent configuration errors.

Documentation

Full docs: secrets-scan